PCI DSS
Stripe Now Asks You to Attest That You've Deployed a CSP
Stripe's PCI assessment now has a mandatory checkbox: confirm you've deployed a Content Security Policy. Here's what you're attesting to, and how to do it.
Newsletter
Newsletter - June 2026
June was all about giving you tighter control over who can reach your account and much richer visibility into what happens inside it. Here's everything we shipped. Single Sign-On with SAML 2.0 - Beta đȘȘ You can now sign in to Report URI through your own identity provider.
Why We Joined the W3C
One thing I've learned over the years is that the best businesses don't simply react to change. They position themselves where change is happening. That applies just as much to cybersecurity as it does to any other industry. Every year, organisations invest millions in new security
Newsletter
Newsletter - May 2026
May has been a busy month at Report URI HQ, with a big push on account security alongside a host of improvements to how we surface threats in your reports. Here's everything we shipped. Device Bound Session Credentials - Beta đ We've implemented the emerging Device Bound Session
The WooCommerce Attack Every Security Executive Should Pay Attention To
A recent WooCommerce attack, analysed by Scott Helme, Report URI's CEO, exposed something many organisations are still struggling to fully grasp: Your website can be actively stealing customer payment data while appearing to function completely normally. No outage. No ransomware. No obvious breach. No backend compromise alerts. Customers
Newsletter
Newsletter - Apr 2026
As we continue to push into 2026, weâve maintained our pace of improving existing features and introducing new ones. API and MCP endpoints - now Generally Available đ€ Our API and MCP endpoints are now Generally Available to customers on a suitable plan! The feedback from the beta was amazing and
White Paper
Passkeys Are a Big Security Upgrade â But Theyâre Not the Whole Story
Passkeys are one of the best improvements to online security in a long time. They are designed to replace passwords with a safer, easier way to sign in. That means no more reused passwords, much less risk from phishing emails, and far better protection against attackers trying stolen login details
Newsletter
Newsletter - Mar 2026
Both January and February were big months for us at Report URI HQ, and we have continued to push forwards in March! API and MCP endpoints - beta invites! đ€ Starting out with what has to be our most exciting news, we are announcing that we have started a closed beta for
NCSC
When Free National Security Tooling Goes Away: Why the Retirement of Web Check and Mail Check Matters
Most organisations donât have a clear view of their external attack surface, whatâs exposed, whatâs changed, and where risk may be building over time. For many UK organisations, the National Cyber Security Centreâs Web Check and Mail Check services have quietly filled part of that gap.
Stripe Is Quietly Raising the Bar on Website Security. Most Security Leaders Havenât Noticed Yet
Stripe has recently updated its security guidance to explicitly require merchants to have visibility into what code is running on their websites. In their certification process is a clear expectation: organisations handling payments should be monitoring client-side behaviour, not just backend systems. This isnât a new regulation or
Newsletter
Newsletter - Feb 2026
After kicking 2026 off with a pretty big update, we've continued to push forwards with a lot of work across the board at Report URI HQ.
Magecart
What the European Space Agency Attack Teaches Security Leaders About Client-Side Risk
In late 2024, extending into 2025, the European Space Agency was forced to take its online store offline following a Magecart-style attack that compromised customer payment data. The incident was not the result of a traditional breach, stolen credentials, or a failure of perimeter security. It happened quietly, inside